3 ms·
> I resisted the temptation to use the exploit to send myself a million dollars worth of free Amazon gift cards Sorry, but that's not how Amazon's "Buy It Now
by micahgoulart 12y ago
> I resisted the temptation to use the exploit to send myself a million dollars worth of free Amazon gift cards
Sorry, but that's not how Amazon's "Buy It Now" option works. It sends the item to the default address on file. So it would not be possible for the clickjacker to get it mailed to their own address.
- joshfraser 12y agoYou can send a gift card to an email address that you specify. I can't seem to do it now, but I remember being able to pre-populate the email address using a GET variable: https://www.amazon.com/gp/product/B004LLIKVU/gcrnsts?ie=UTF8&qid=1402093716&ref_=sr_1_1&s=gift-cards&sr=1-1 https://www.amazon.com/gp/product/B004LLIKVU/gcrnsts?ie=UTF8...
- giulianob 12y agoWould it be possible to use this to sell items with you as a referral and get paid commission?
- joshfraser 12y agoYes, but even better, you could list your own products on Amazon and get paid whatever amount you want. Of course, there's no way to stop the email receipts from Amazon, but you might be able to get away with it for short period of time.